Switching between environments, staging to production, testing to sandbox, each needed its own set of keys, regions, and configurations. The AWS CLI profiles made that easier—one command, one profile, clean separation. But for SOC 2 compliance, the job wasn’t done. We had to prove it.
SOC 2 wants strong controls, clear audit trails, and strict separation of duties. The same things good engineers want when working in cloud environments. AWS CLI-style profiles fit right in: each environment gets a named profile, backed by its own IAM user or role, locked down by least privilege. Credentials rotate automatically. Access logs stay linked to a human and a purpose.
Done right, this approach makes compliance checks less painful. You can trace every action. You can prevent accidental cross-environment access. You can answer security reviewers with specifics instead of shrugs. Defining profiles in ~/.aws/config with clear, permanent naming—dev-readonly, prod-admin, compliance-audit—means you never guess which context you’re in. MFA enforcement locks profiles down even tighter.